OneDrive for Business external sharing links troubleshooting for finance teams: open as access denied

Finance teams at your company use OneDrive for Business to share sensitive financial reports, budgets, and audit files with external auditors, tax consultants, or board members. When external recipients click a sharing link, they see an Access Denied page instead of the file. This problem stops critical work and creates security risks if you try to work around it with unapproved methods. The root cause is almost always a mismatch between the sharing link configuration, the recipient’s authentication method, and your tenant’s external sharing policies. This article explains the exact technical cause of the Access Denied error for external OneDrive links and provides step-by-step fixes that finance IT administrators can apply immediately.

You will learn how to diagnose link permission settings, check tenant-level sharing policies, and configure the correct link type for external financial collaborators. Each fix is tested against real-world finance workflows such as sharing a quarterly P&L statement with an external CPA firm.

Why External Recipients See Access Denied on OneDrive Sharing Links

When a finance team member creates a sharing link in OneDrive, the link carries a permission type and an access scope. The permission type determines whether the recipient can view or edit the file. The access scope defines who can use the link: anyone, people in your organization, people with existing access, or specific people. The Access Denied error occurs when the link scope excludes the external recipient or when the recipient’s identity cannot be verified by your tenant.

The most common technical cause is selecting People in your organization as the link scope. This scope requires the recipient to have a Microsoft 365 account in the same tenant. External auditors and consultants do not have accounts in your tenant, so the link refuses access. Another frequent cause is a tenant-level policy that blocks external sharing for sensitive file types such as .xlsx or .pdf. Finance teams often store reports in these formats, and the global admin may have applied a Data Loss Prevention rule or a SharePoint sharing policy that restricts external access to specific file extensions.

Expiration and Password Policies Blocking Access

Even when the link scope is correct, the link itself may have expired. OneDrive allows admins to set a default link expiration period, such as 30 days. If the finance user created the link four weeks ago and the recipient clicks it on day 31, the link is dead. Similarly, if the tenant requires a password on all external sharing links and the sender did not provide the password to the recipient, the recipient sees Access Denied with no prompt to enter a password.

Guest Account Status in Azure AD

When an external recipient clicks a sharing link that requires authentication, OneDrive tries to create a guest user object in your Azure Active Directory. If the guest invitation settings block self-service sign-up or require an admin to approve each guest, the recipient will be denied. Finance teams frequently share with individuals who are not in your Azure AD, so this setting is critical.

Steps to Diagnose and Fix the Access Denied Error on OneDrive External Links

Follow these steps in order. Each step resolves a specific cause of the Access Denied error.

1. Check the link type in OneDrive
   Open OneDrive in a browser. Locate the file that was shared. Click the file and select Share. In the sharing dialog, look at the link type displayed at the top. If it says People in your organization, change it to Specific people. Type the external recipient’s email address. Set the permission to View or Edit based on the file sensitivity. Click Apply. Send the new link to the recipient.
2. Verify the external sharing policy in the Microsoft 365 admin center
   Go to Microsoft 365 admin center > Settings > Org settings > OneDrive > Sharing. Under External sharing, confirm that Allow external sharing is enabled. Check the Link settings section. If Allow only specific domains is enabled, add the recipient’s email domain. If Block external sharing for sensitive file types is enabled and your file is .xlsx or .pdf, disable this block or create an exception for the finance team’s shared library.
3. Review Azure AD guest invitation settings
   Go to Azure AD > External Identities > External collaboration settings. Under Guest invite settings, select Anyone in the organization can invite guest users including guests and non-admins. Under Guest access restrictions, select Guest users have the same access as members for finance-shared content. Save the changes. This allows external recipients to accept the sharing link without an admin approval.
4. Check link expiration and password requirements
   In the Microsoft 365 admin center, go to Settings > Org settings > OneDrive > Sharing. Look at the Expiration setting. If it is enabled, note the default number of days. Instruct the finance user to create a new link with a longer expiration or to set No expiration on the link. If a password is required, the sender must include the password in a separate email or secure message. Do not embed the password in the same message as the link.
5. Test with a new link using anonymous access (if allowed)
   If your compliance policy allows, create an Anyone with the link sharing link for a test file. This bypasses authentication entirely. If the recipient can open this link but cannot open the Specific people link, the issue is the guest account creation or the recipient’s sign-in method. Contact the recipient and ask them to use a Microsoft account or a work/school account that matches the email domain you specified.

If External Sharing Links Still Show Access Denied

The recipient’s email domain is in the blocked domains list

Finance teams often share files with domains like @auditorfirm.com or @consultant.com. If a global admin has added these domains to the Blocked domains list in SharePoint admin center or Azure AD, all external sharing links to those domains will fail. Go to SharePoint admin center > Policies > Sharing. Under External sharing, check Limit external sharing by domain. Remove the blocked domain or add the domain to the allowed list.

The file is in a library with custom permissions

If the OneDrive folder or file has unique permissions that do not include the external recipient, the link will deny access. Ask the finance user to verify permissions by clicking the file, selecting Manage access, and confirming that the external recipient appears in the list. If the recipient is not listed, add them directly using their email address and set the permission level to Read or Contribute.

Conditional Access policies block external access

Azure AD Conditional Access policies can require multi-factor authentication, compliant devices, or specific locations for access to OneDrive. External recipients may not be able to meet these requirements. Work with your security team to create a Conditional Access policy exception for external guest users accessing finance-specific OneDrive sites. Use the Cloud apps or actions condition to target the OneDrive app and the Conditions > User risk setting to exclude guests.

Item	Link Type: Specific People	Link Type: Anyone with the Link
Description	Requires the recipient to sign in with a Microsoft account or work/school account	No sign-in required; anyone who has the link can open the file
Best for finance	Auditors, tax consultants, board members with a known identity	One-time file drops for anonymous submitters
Security risk	Lower; access is tied to an authenticated user	Higher; link can be forwarded to unauthorized parties
Expiration support	Yes; admin can set default expiration	Yes; admin can set default expiration
Password support	Optional; admin can require a password	Optional; admin can require a password

After applying the fixes above, have the finance user create a new sharing link using the Specific people type. Ask the external recipient to clear their browser cache and cookies before clicking the link. If the Access Denied error still appears, use the OneDrive sharing diagnostic tool in the Microsoft 365 admin center. Go to Support > New service request and select OneDrive sharing. The diagnostic will check link permissions, tenant policies, and guest account status in real time.